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Abstract 

Given a recursive ordinal A, the transfinite provability logic GLPa has 
for each £ < A a modality [£] with the intention of representing a sequence 
of provability predicates of increasing strength. One possibility is to read 
[£]</) as (j> is provable in T using an u)-rule of depth £, where T is a second- 
order theory extending ACAo. 

In this paper we shall fomalize this notion in second-order arithmetic. 
Our main results are that, under some fairly general conditions for T, the 
logic GLPa is sound and complete for the resulting interpretation. 



1 Introduction 

One compelling and particularly successful interpretation of modal logic is to 
think of □(/> as the formula <f> is provable, where provability is understood within a 
formal theory T capable of coding syntax. This was suggested by Godel; indeed, 
if we use (}<f> as a shorthand for -O ->(/>, the Second Incompleteness Theorem 
could be written as ()T — > 0d_L It took some time, however, for a complete 
set of axioms to be assembled, namely until Lob showed □(□</> — > <f>) — > Dcf> to 
be valid. It took longer still for the resulting calculus to be proven complete by 
Solovay [T^]. The resulting modal logic is called GL (for G6del-L6b). 

Later, Japaridze [TU] enriched the language of GL by adding a sequence of 
provability modalities [n], for n < to. The modality [0] is now used as before 
to state that <j> is derivable within some fixed formal theory T, while higher 
modalities represent provability in stronger and stronger theories. There are 
many arithmetic interpretations for Japaridze's logic, and one of them also 
stems from an idea of Godel, who introduced the notion of a theory T being 
uj- consistent: T is uj-consistent whenever for any formula if T h <f>(n) for all 
n E N, then T V 3x~Kp(x). Dually to this notion one can define a notion of 
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w-provability: <fi is cj-provablc in T whenever T + —\<f> is cj-inconsistent. One 
may then interpret [l]<f> as <fi is u-provable; a detailed discussion of this is given 
in Boolos [BJ. 

One can then go on to interpret the higher modalities by using iterated uj- 
rules. This idea was already explored by Japaridze and gives an interpretation 
for which the polymodal logic GLP^ is sound and complete; Ignatiev [S] and 
Beklemishev [4] later improved on this result. This logic is much more powerful 
than GL, and indeed Beklemishev has shown how it can be used to perform an 
ordinal analysis of Peano Arithmetic and its natural subtheories pQ . 

Our (hyper)arithmctical interpretations will be a straightforward general- 
ization of Japaridze's where we read [ajr^ as The formula 4> is derivable in T 
using co-rules of nesting depth at most a; we shall make this precise later. We 
do this by considering a well-ordering -< on the naturals and defining a logic 
GLP^. This is a variation of GLPa already studied by the authors and Beklem- 
ishev |S] , with the sole difference that we shall represent ordinals as natural 
numbers rather than appending them as external entities. 

Our main result is that GLP^ is sound and complete for arithmetical in- 
terpretations on 'suitable' theories T; we will mainly work with extensions of 
ACAo, but as we shall discuss later, it is possible to work over a weaker base 
theory. 

Plan of the paper Section [2] gives a quick review of the logics GLP^ as well 
as their Kripke semantics, and Section [3] of second-order arithmetic. Section 
[4] formalizes the notion of iterated w-provability in second-order arithmetic; 
this notion is most naturally interpreted in introspective theories, introduced in 
Section [5j Section [6J proves that GLP^ is sound for our interpretation. In order 
to prove completeness, Section [7] gives a brief review of the modal logic J, which 
is used in the completeness proof provided in Section [51 Finally, Appendix [B] 
discusses our choice of base theory and Appendix [A] possible variations on the 
notion of iterated w-provability. 

2 The logic GLP^ 

Formulas of the language Ln are built from _L and countably many prepositional 
variables p 6 P using Boolean connectives ->, A and a modality [£] for each 
natural number £. As is customary, we use (£) as a shorthand for ^[^J- 1 . 

If ^ is a binary relation on the naturals, the logic GLP^ is given by the 
following rules and axioms: 

1. all prepositional tautologies, 

2. [£](0-^)^(K]0^K]V')f°ralU, 

3- [£]</> for alU, 

4. (C) 4> -> (0 4> for £ ~< C, 
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5- (0 4> -> [C] (0 for i< c, 

6. Modus Poncns, Substitution and Necessitation: 7-7-. 

We will normally be interested in the case where -< is a well-order, in which case 
it is known that (£)T is consistent with GLP^ for all £ (see [5]). In case -< is a 
recursive well-order of order-type A we shall often write GLPa instead of GLP^ 
making the necessary definitional changes for finite order types A. 

We shall also work with Kripkc semantics. A Kripke frame is a structure 
$ = (W, (Ri)i < i), where If is a set and (Ri) i<: i a family of binary relations on 
W. A valuation on 5 is a function [•] : Lr.i —5- P(W) such that 

M = 

[-.0] = w\m 

[<MV>] = l<g n M 

m<g = r^M- 

A Kripke model is a Kripke frame equipped with a valuation [•]. Note that 
propositional variables may be assigned arbitrary subsets of W. Clearly, a valu- 
ation is uniquely determined once we have fixed its values for the propositional 
variables. As usual, <j> is satisfied on [•]) if \<t>\ 7^ 0, and valid on [•]) if 

m = w. 

It is well-known that polymodal GL is sound for g whenever i?j 1 is well- 
founded and transitive, in which case we write as <j. However, construct- 
ing models of GLPa is substantially more difficult than constructing models of 
GL, since the full logic GLPa is not sound and complete for any class of Kripke 
frames. In Section [7] we will circumvent this problem by working in Bcklcmi- 
shev's J, a slightly weaker logic that is complete for a manageable class of Kripke 
frames. 

3 Second-order arithmetic 

Aside from the modal language Lr.i , we will work mainly in the language Ly of 
second-order arithmetic. 

We fix some primitive recursive Godel numbering mapping a formula ip £ Ly 
to its corresponding Godel number r ip^, and similarly for terms and sequents of 
formulas (used to represent derivations). Moreover, we fix some set of numerals 
which arc terms so that each natural number n is denoted by exactly one numeral 
written as n. Since we will be working mainly inside theories of arithmetic, we 
will often identify ip with r ijj~ > or even with r ip~ i for that matter. 

Our results are not very sensitive to the specific choice of primitive sym- 
bols; however, to simplify notation, we will assume we have the following terms 
available: 
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1. A term (x, y) which returns a code of the ordered pair formed by x and y. 

2. A term x[y/z] which, when x codes a formula <j), y a variable v and z a 
term t, returns the code of the result of subsituting t for v in <j). Otherwise, 
its value is unspecified, for example it could be the default r _L n . We shall 
often just write <p(t) for this term if the context allows us to. 

3. A term x — > y which, when x, y are codes for <p, ip, returns a code of 
4> — > tp, and similarly for other Boolean operators or quantifiers. The 
context should always clarify if we use the symbol — > as a term or as a 
logical connective. 

4. A term x mapping a natural number to the code of its numeral. 

5. For every formula </>, a term 4>(x) which, given a natural number n, returns 
the code of the outcome of 4>[x/n], i.e., the code of 4>(n). 

We will also use this notation in the metalanguage. The only purpose of 
assuming these terms exist is to shorten complex formulas, as the graphs of all 
these functions are definable by low level arithmetic formulas over most standard 
arithmetic languages. 

As is customary, we use Ag to denote the set of all formulas (possibly with set 
parameters) where all quantifiers are "bounded" , that is, of the form \/x < y <j> 
or 3x < y 4>. We simultaneously define E° = IIq = Ag and E° +1 to be the set 
of all formulas of the form 3xq . . . 3x n (j) with <p € 11° and similarly 11° +1 to be 
the set of all formulas of the form Mxq • ■ -Vx n ^) with 4> £ E°. We denote by 11° 
the union of all 11°; these are the arithmetic formulas. 

The classes E* , II* are defined analogously but using second-order quantifiers 
and setting = IIq = Ag = 11°. It is well-known that every second-order 
formula is equivalent to another in one of the above forms. If T is a set of 
formulas, we denote by T the subset of T where no set variables appear free. 

Wc will say a theory T is representable if there is a Ag formula Proof y (a;, y) 
which holds if and only if x codes a derivation in T of a formula coded by y; in 
general wc assume all theories to be representable. Wc may also assume without 
loss of generality that any derivation d is a derivation of a unique formula 0, for 
example by representing d as a finite sequence of formulas whose last element 
is <p. Also, we assume that every formula that is derivable has arbitrarily large 
derivations; this is generally true of standard proof systems, for example one may 
add many copies of an unused axiom or many redundant cuts. Whenever it does 
not lead to confusion we will work directly with codes rather than formulas; if (f> 
is a natural number (supposedly coding a formula) we use U\t4> as a shorthand 
for By Proof x{y, 4>)- 

It is important in this paper to keep track of the second-order principles that 
are used; below we describe the most important ones. We use < to denote the 
standard ordering on the naturals and T denotes some set of formulas: 
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T-CA 3X\/x{x G X o <j)(x)) where <j> G T: 

I-T 0(0) A Vx(<f>(x) 0(.t + T)) ->• Vx</>(x) where G T; 
Ind \/x(V y<xy £ X x £ X) — > \/xx£X, 

We assume aZZ theories extend two-sorted first-order logic, so that they include 
Modus Ponens, Generalization, etc., as well as Robinson's Arithmetic, i.e. Peano 
Arithmetic without induction. 

Another principle that will be relevant to us is transfinite recursion, but this 
is a bit more elaborate to describe. For simplicity let us assume that Ly contains 
only monadic set- variables; binary relations and functions can be represented 
by coding pairs of numbers. It will be convenient to establish a few conventions 
for working with binary relations in second-order arithmetic. First, let us write 
R is a binary relation and f is a function: 

rel(R) = Vx(x G R -> 3y3z(x = (y, z))\ 
funct(/) = rel(/) A \/x3\y((x, y) G /). 

Here, 3! is the standard abbreviation for there exists a unique. 

Also for simplicity, we may write n R m if R represents a relation and 
{n,m} G R as well as n R in for m) G R), or n = f(m) if (m,ri) G / and 
/ is meant to be interpreted as a function. Further, it is possible to work with 
a second-order equality symbol, but it suffices to define X = Y by \/x(x G X 
V 6 Y). _ 

It will also be important to represent ordinals in second-order arithmetic. 
For this we will reserve a set- variable -<. Here, we will need to express the rela- 
tion -< is a linear order and the relation -< is well-ordered, as follows: 

linear(^) : 

Vx(^(x ~< x) A Wy(x -<yVy~<xVy~ x)) AVi,j/,z (x-<y A y~<z —> x~<z); 
wo(-<) : 

linear(^) A VAT (3x(x G A) -> 3yVz(z -< y -4- -n(z G A))^. 

We will use Greek letters for natural numbers when viewed as ordered under -<. 
When it is clear from context we may use natural numbers to represent finite 
ordinals, so that, for example, is the least element under -<, independently of 
whether it truly corresponds to the natural number zero. 

We shall often want that the elementary properties of -< be provable, for 
example, 

This can be guaranteed if we work with recursive well-orders, in which case 
we assume T contains an axiom Vx, y (x -< y O o~(x,y)) for some formula 
a(x,y). 
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Transfinite recursion is the principle that sets may be defined by iterating 
a formula along a well-order. To formalize this, let us consider a set X whose 
elements are of the form (£, x). Write Aj for {x \ (£,x) <E X} and X^ for 
{x | 3 (C,x) G X}. Then, given a set of formulas T we define 

TR-r wo(-0 BAV^Vx (a; e o 0(x, X^)) for e T. 
With this, we may define the following systems of arithmetic: 

RCA := I-E? + Ag-CA 
ACA := Ind + II°-CA 
ATR := Ind + TR-IT°. 

We list these from weakest to strongest, but even ATRo is fairly weak in the 
realm of second-order arithmetic. For convenience we will work mainly in ACAo, 
but later discuss how our techniques could be pushed down even to below RCAo 
at the cost of slightly stronger transfinite induction. 

The system ATRo is relevant because we will define iterated provability by 
recursion over the well-order -<. However, as we shall see, we require much less 
than the full power of arithmetic transfinite recursion. 

In various proofs we wish to reason by transfinite induction. By Tl(-<, <f>) we 
denote the transfinite induction axiom for <p along the ordering -<: 

TIK 0) := V£ (VC< 0(0 -> HO) -> V^(f). 

We will write 0-CA instead of {0}-CA, i.e., the instance of the comprehension 
axiom stating that {x \ </>(x)} is a set. The following lemma tells us that we 
have access to transfinite induction for formulas of the right complexity: 

Lemma 3.1. In any second order arithmetic theory containing predicate logic 
we can prove 

wo(-<) A -.0-CA — » TI(-<, 4>). 

Proof. Reason in T and assume wo(-<) A -i0-CA. We prove Tl(^<, <j>) by contra- 
position. Thus, suppose that 3A->0(7). As {£ | ~«f)(£,)} is a set, we can apply 
wo(-<) to obtain the minimal such A. Clearly for this minimal A we do not have 
VC^A 0(C) 0(A). □ 

4 Nested w-rules 

In this section we shall formalize the notion of iterated w-rules inside second- 
order arithmetic. In Boolos ([B]) it is noted that multiple parallel applications 
of the w-rule do not add extra strength. For example, the rule that allows us to 
conclude a from 

Vn h ip{n) 
Vra h \/xif>(x) — > 0(m) 
h Vx 4>{x) — > a 
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can actually be derived by a single application of the lu rule. 

However, when we admit slightly less uniformity by allowing iji to depend 
on m in this rule, and adding the premises Vn h ip m {n) we get our notion of 2- 
provability. More generally, we may iterate this process to generate a hierarchy 
or stronger and stronger notions of ^-provability for a recursive ordinal £. It is 
the nesting depth that gives extra strength and not the number of applications. 

Wc will use [A]^0 to denote our representation of The formula <j) is provable 
in T using one application of an io-rule of depth A (according to -< ). The desired 
recursion for such a sequence of provability predicates is given by the following 
equivalence 

[\]l<f> o (qhW3V>3^:A (yn [^ip(n) A □ T (Va^(s) -»• </>))) . (1) 

As a first step in such a formalization, we will use a set X as an 'iterated prov- 
ability class' IPC for short. Its elements are codes of pairs (A, </>}, with A a code 
for an ordinal and <fi a code for a formula; we use [A]jf</> as a shorthand for 
(A, (f>) <E X and (\)x4> f° r (\ -,< />) ^ -X"- Clearly, any IPC will depend on a pa- 
rameter -< whose intended interpretation is a well-ordering on the naturals. We 
then define a formula IPC^ (X) ('iterated provability class') as a formalization of: 

[A]x</> if and only if 

1. A = and Dt0> or 

2. there is a formula tp( x ) an d an ordinal £ -< A such that 

(a) for each n < uj, [£]xi/>(n), and 

(b) a T (Vxi>(x) -> </>). 

Intuitively, we understand IPC^(X) as stating "X is an iterated provability 
predicate" and in the remainder of this text we will use both 'class' or 'predicate' 
to refer to IPCs. Let us enter in a bit more detail: 

Definition 4.1. Define Rule^(A, (j> \ X) by 

3^3£^A (Vn [£]xV(n) A Dr(Va^(aO -> 0) 
erne? let IPCy(X) 6e i/ie formula 

Vz 



e X o- 3A30 (2 = (A, 0) A (□t</ ) V RuleJ(A, | X) 
Then, [\]£<f) is the U\-formula VX(IPC^(X) -> [\]x<f>)- 



1 There are other reasonable ways of defining this recursion. In Appendix [A] we shall 
discuss some possible alternatives. 
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Note that the formulas [X\x<P and {^)x4> are independent of T and of -< and 
are merely of complexity A§. Note also that for r.e. theories T we have that 
Rule^ (A, | X) is a E^-formula whence IPC^(X) is a II§-formula. We can write 
the definition of IPC^(X) more succinctly as 

IPC^(X) o Ve,0([eW O (□ r 0VRule^(^|X))). 

From the definition of our provability predicates we easily obtain monotonicity: 

Lemma 4.2. Given theories U,T where U extends ACAo and T is repre- 
sentable, we have that 

Proof. We reason within £/. Suppose [£]^</> holds as well as IPC^ (X). Letting a; 
be any variable not appearing in </> we have that </>(«■) holds for all n < cj as 
well as □t^Vz^ — ► 0). Thus, [Qxrf 1 an d, since X was arbitrary, [£]^</> holds. □ 

Corollary 4.3. Lei f7 and T be as in Lemma\Jl!\ If TV- <j), then T h [\]£<f>. 

Proof. If T h </> then Dt0 is a true Ej sentence whence t7 h Qr<^- Thus also 
{/ h [O]^0 and by monotonicity (Lemma 14. 2j) . we get U h [A]^(/>. □ 

Our notion of ^-provability, is a very weak one as it has a universal 

quantification over all provability predicates X and it may be the case that 
there are no such predicates. Dually, the notion of consistency is very 

strong as it in particular asserts the existence of a provability predicate. In 
particular, we always provably have 

U T cp ->■ [0]^. (2) 

However, we can in general not prove [0}^<f> — » Dt4>. Nevertheless, the two 
notions of provability coincide under the assumption that a provability predicate 
exists: 

Lemma 4.4. Given a representable theory T and a theory U that extends ACAo 
we have 

U h 3AIPC^(A) -> (D T 4> O [0]t<I>)- 

Proof. The proof is straightforward and is left to the reader. □ 

In the field of formalized provability one often uses formalized E^ complete- 
ness (see e.g. [5]): 

Lemma 4.5. Let T be some representable arithmetic theory with induction for 
all Ajj formulas (i.e., Aq without free set variables) and where exponentiation 
is provably total. Let a be a E° formula. We have 

TV- a -> n T a. 
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Of course, it makes really no sense to speak of provable completeness 
where we allow free set variables. In particular we cannot apply it to our notion 
[0]x</>, which is why Lemma FOl will often be useful. 

A useful fact is that [A]^0 is well-defined in the following sense: 

Lemma 4.6. Given theories U, T where U extens ACAo and T is representable, 
we have that U proves 

wo(-<) -> vxvf(ipc^(X) a ipc^(F) ->• Vx (xex o zeF)). 

Proof. This follows by a simple induction over -<,. □ 

Moreover, under the assumption of wo(^;) we can also show a useful mono- 
tonicity property of our provability predicates. 

Lemma 4.7. Let U be some theory extending ACAo and let T and T' be rep- 
resentable theories. Write T C T' as a shorthand for \/<j) Dt4> — > Ot'4>. 
Then, 

U + vo(-<) hTCT'4 ([X]t4>^ Wt'^)- 

Proof. Reason in U + wo(-<) and assume that T C T' . By an easy induction on 
A it is shown that if both IPC^(X) and IPC^,(A'), then (A, ^6l-> (A, <j)) £ 
X'. □ 



5 Introspective theories 

For a theory T to be able to reason about non-trivial facts of iterated provability 
at all, it is necessary for it to at least "believe" that such a notion exists. For 
strong theories this is not an issue, but there is no reason to assume that ACA 
or any weaker theory is capable of proving that we have provability predicates. 
Hence we shall pay attention to those theories that do have them, and we shall 
call them introspective theories. 

Definition 5.1 (Introspective theory) . An arithmetic theory T is -(-introspective 
if TV- 3AIPC^(AT). 

We defined provability operators by transfinite recursion, and as such it 
should be no surprise that ATRo is introspective: 

Lemma 5.2. Given an elementarily presented theory T , 
ATR I" wo(-<) -> ElAlPCy (-<, X). 
In particular, ATRo is introspective. 

However, we wish to work over much weaker theories than ATRo, which 
may not be introspective. Our strategy will be to consider some sort of an 
"introspective closure", but do not wish for it to become much stronger than 
the original theory. Fortunately, this is not too difficult to achieve. 
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Definition 5.3. We define the ^-introspective closure of T as the theory T 
given by T + 3XIPC^ (X) . 

Below, we use the term "Godelian" somewhat informally as being susceptible 
to Godel's second incompleteness theorem; for example, it could be taken to 
mean sound, representable and extending RCAo. 

Lemma 5.4. T is equiconsistent with T , provided T is Godelian and contains 
Aq comprehension. 

Proof. Clearly the consistency of T implies the consistency of T. For the other 
direction we use that if T is Godelian, then T is equiconsistent with T" := 
T + D T ±. We claim that T h 3XIPC^(X) so that T' DT whence 

Con(T) =>■ Con(T') 
Con(T). 

Indeed, reasoning within T, if T were inconsistent, then \3t4> for every for- 
mula </>. It follows that if X is an iterated provability operator, then [A]x<^ 
for all A and </>; hence the trivial set consisting of all pairs (A, <j>) is an iterated 
provability operator, and by Aq comprehension, it forms a set. □ 

There is still a danger of sliding down a slippery-slope, where T is itself 
not introspective, thus needing to generate a sequence of theories that is each 
"introspective over the previous" . Fortunately, this is not the case. In order to 
show this we need a technical lemma reminiscent of the Deduction Theorem. 

Definition 5.5. Let X be an iterated provability operator, so that IPCp(X) 
holds. We define the set X given 6 -which we denote by {X\9}~ as 

(\,<f>) e {X\9} (A, 6 -»■ <j>) e X. 

The technical lemma that we shall now prove tells us in particular that 
introspection is preserved under taking finite extensions. 

Lemma 5.6. Let U be some theory containing Aq comprehension, and let T be 
representable. Then 

UhIPCl(Y)^IPCl +e ({Y\9}). 

Proof. We reason in U and assume IPC^ (Y). By Aq comprehension we see that 
{Y\6} is a set. We need to show that [\]{ Y \9}<f> O □T+e0VRule^ +e (A, 4> I {^l^})- 
Since 

[\] {Y \e}4> ^ [A]y(0->0) 

«-> a T {9 -> 4>) VRule^(A,6> -> <j> \ Y), 

and since Dr+e^ Ot(0 —> </>), it suffices to show Ruley +6 ,(A, | {^1$}) <H> 
Rule^(A,6> -» <j)\Y). 

But this follows easily from the tautology 

(6 (Vxtjj(x) <f)) <-> (Vx (6 ^(x)) -> (0 0)) 

and the definition of {^1$}. □ 
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As a direct consequence of this lemma we see that the introspective closure 
of a theory is indeed itself introspective. 

Lemma 5.7. Using Ag comprehension one can show that T is introspective. 

Proof. By the above Lemma 15. 6[ if Y is a provability predicate for T, then 
{Y\3XIPC^(X)} is a provability predicate for T. Moreover, by Ag comprehen- 
sion, it forms a set. □ 

We conclude that working with introspective theories is not too restrictive: 

Corollary 5.8. Every Godelian theory T is equiconsistent to an introspective 
theory T . 

Note that in general we may not expect for U to prove 3Xl¥C^ +g {X) — > 
3XTPC^,(X) since for 9 = Dt-L the antecedent always holds (recall the proof of 
Lemma 15.41) . 

A problem that T has is that it introduces an existential second-order for- 
mula, which may make it hard later to control the complexity of the resulting 
theory. Because of this, it is sometimes more convenient to work with explicitly 
introspective theories: 

Definition 5.9. Given a formal theory T , we define T 71 " over the language 
Ly + {tt}, where ir is a new set-constant and T" = T + IPCy(7r). 

Much as with T, T v is introspective, provided T contains Ag comprehension. 
In fact, we can do a bit better in this case. Recall that, given a class of formulas 
r, r denotes the set of those formulas of T with no open set variables; excluding 
7r, of course, which is a constant. Then we have the following: 

Lemma 5.10. Using Ag comprehension one can prove that T^ is introspective. 

The proof proceeds as before and we omit it. Parameter-free comprehension 
is very convenient in that it does not "blow up", as it cannot be iterated; for 
example, III comprehension with set parameters is equivalent to full arithmetic 
comprehension, but comprehension is not. 

Now that we have shown that introspective theories are not such a bad thing 
to work with, we will employ them freely in the next sections. Introspective the- 
ories are capable of reasoning about their own iterated provability; for example, 
we may prove the desired recursion as stated in ([1]). 

Lemma 5.11. Let T be a theory that extends ACAo. Then, we have that 

1. TV- (Dr0v3^3C-<A (Vn [£]^V(n) A n T (Vxip(x) -►</>))) -> [X}^<t>; 

2. TV- [\}^4> o far0v3V>3£-<A (Vri [^tp(n) A □ T (Vx^(x) 
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Proof. In the first item, we reason in T and need to prove [A]^</> under the 
assumption of the antecedent. To this end, we fix some X with IPC^(X) and 
show [A]x<^- However, this follows directly from the definition of X being a 
provability predicate since we can replace Vn [Clj^n) in the antecedent by 
Vn [€]xi>(n). 

For the remaining implication in the second item we reason as follows. In 
case A = we get the implication by Lemma 14.41 In case A > 0, from the 
definition we see that for any provability predicate X we have 

[X]x4> ->• (Or^vaV^A (yn [£] x ip(h) A U T (yxtj}{x) ->• </>))). 
From this we obtain 



[A]^ 



WsT IPC^(X) 

(n T (j> V 3^3^ A (Vn A □ r (Vx^(x) -> 0)) 



from which the claim directly follows. 



□ 



6 Soundness 

In this section we shall see that indeed GLP^ is sound for its arithmetic interpre- 
tation. In Lemma 14.21 we have already seen the soundness of the monotonicity 
axiom [£]</> — > [Q(f> for £ -< £. For the remaining axioms we will transfinite in- 
duction over -< so we define, given a second-order theory T, a new theory 
as 

7^ :=T + wo(^). 

We will assume that T contains ACAo, although in Appendix iBl we shall discuss 
this choice. Since introspection is closed under taking finite extensions both 
T and are introspective (though not necessarily equivalent); for all our 
arguments below it is irrelevant which one we use. 

Let us first check the soundness of the basic distribution axiom. 

Lemma 6.1. Given theories U,T where U extends ACAo and T is repre- 
sentable, then 

h [\\${<k -> <h) -> (W^i -> [\]$<h)- 

Proof. We reason within J7 X . 

Let X be a provability predicate. We shall prove by induction on A that 

V<h,<h (Wx<h A [\]x(<h <h) [Ajjr^a). (3) 

Note that by Lemma 13. II we only need comprehension (with set parameters) 
to have access to this transfinite induction. 

So, we assume that [A]x</>i A [A]x(</>i — >• 02 ) and let ?/>i, V>2 be such that 
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1. for each i = 1, 2 there is £j < A such that for all n < lj, (£i,ipi(n)) G X, 

2. Ut^x^x) -> 4>i), 

3. Dr(Va^2(a?) -> -»> £0). 
By first-order logic we see that 

□r(Vx(^i(x) A0 2 (x)) -+0 2 ). (4) 

Let £ = maxj^i,^}- By induction on £ -< A and several uses of Modus 
Poncns inside [£]x we obtain for each n that [■^xdV'itX) A-02(X))- But given 
that X is an IPC, this shows in combination with @ that [A]x 4>2 and we have 
shown 

To conclude the proof, we assume that [A]^(0i — > 2 ) A [A]^0i. Thus, for 
an arbitrary provability predicate X we have [A]x(0i ~~ > 4>i) A [A]x0i whence 
by ([3]) also [A]x02- As X was arbitrary, we obtain [A]^0 2 . D 

With our distribution axiom at hand we can now obtain a formalized De- 
duction Theorem. 

Lemma 6.2. Let U be a theory extending ACAo and let T be representable. 
We have that 

Proof. If [A]^(0 — > (f>) then, by Lemma T4.7I we also have [X]^ +g (0 — > 4>). Since 
clearly [X]^ +g 9, by the distribution axiom we get [A]^ +e 0. 

For the other direction, reason in and assume [X]^ +g (j>. Let X be 
arbitrary with IPC^(X). By Lemma U we see that IPC^ +e ({X\9}). Now 
by the assumption that [A]y +e </> we see that [A] {x|6>}0 so that consequently 

[\]x(0-Kj>). □ 

So far we have shown that some of the axioms of GLP^ arc sound for our 
omega-rule interpretation; Lob's axiom and the "provable consistency" axiom 
remain to be checked. For the former, the following lemma will be quite useful. 

Lemma 6.3. Extend GL with a new operator ■ and the following axioms for 
all formulas 4>, and tp: 

1. h \3<f> -> m<j>, 

2. h U(<f> -tip)-> (M<f> -> Mip) and, 

3. h m<j) -> um<>. 

and call the resulting system GL B . 
Then for all <fi, 

GL" h U(M(j) -> 4>) -> ■(/>. 
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Proof. It is well-known that GL is equivalent to K4 plus the Lob Rule: 

(/> ' 

Thus it suffices to check that this rule holds for ■. But indeed, assume that 
GL B h Bo — > </>. Then, using D<f> — > M(f> we obtain \3<f> — > <f>, and by Lob's rule 
(for □) we see that GL B h <fc, as desired. □ 

Thus to show that [A]^ is Lobian for all A, we need only show the following: 

Lemma 6.4. Given a recursive order -<, theories U,T where U extends ACAo 
and T is representable, we have that 

h V0VA [A]^0 -> [A]^[A]^0. 

Proof. Reason within U^. We assume IPC^(X) and will show by induction on 
-< that if [A]x</>, then [A]x[A]y0, from which the lemma clearly follows. 

The base case, when A=0, is straightforward. We assume [O]x0 and by 
Lemma 14.41 we get Dt4> whence OtOt4> by provable E^-completeness of U. 
Consequently, by applying © twice (once under the box) we obtain [O]^[O]^0 
whence certainly also [O]x[O]^0. 

Now assume that A >- and there are £ -< A and ip such that for all n, 
[£.}xip(n) and □t(V.t?/>(x) -» (f>). 

By the induction hypothesis on £ -< A, for every number n we can see that 
[£]t'^("')- Thus we obtain by one application of the w-rule that 

[A]xVn[£]^(n). (5) 

Meanwhile, we have that [0}xOt{VxiP(x) —> </>) from which it follows by 
monotonicity that 

[\} x n T (Vx$(x) -> 0). (6) 
Since -< is recursive we also have that 

[A]x<HA. (7) 

Putting ([5]), ([5]) and ([7]) together and bringing the existential quantifiers under 
the box we conclude that 

[A]x(3^3^A (Vn[£]^(n) A U T {ixi>{x) ->- 0))). 

By an application under the box of Lemma 15.11111 (note that no need of intro- 
spection is required) we obtain [A]x[A]^0 as was to be proven. □ 

In the proof of the remaining GLP^ axiom we will need for the first and only 
time the assumption that T is introspective. 

Lemma 6.5. If U is any theory extending ACAo, -< is recursive and T is 
representable and -introspective, then 

h V<?(>VAV£ -< A -> [MriOT^- 
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Proof. We reason in i/ x and assume that £ -< A. Let us first see that it is 
sufficient to show that for an arbitrary provability predicate X we have (£)jc</> — > 

If we wish to show [A]^(£)Ji</> we pick an arbitrary provability predicate X 
and set out to prove [X]x(0t4>- By the assumption {£)^</> we know that there 
is some provability predicate Y with (£,</>) ^ that is. (£)y</>- By Lemma BUI 
we have that X = Y, whence {(,)x<t> an d indeed, (£)x<t> — ► [A]x(£)t^ suffices to 
finish the proof. 

In view of the above, we will prove (£}x</> — ^ [A]x(£)t^ by induction on A. 
For the base case, when A = 1, we reason as follows. From (Q)x4>, we obtain 
the Ii\ sentence 0t</>, that is, Vn^Proof r(n, <f>). Since -iProof r{n, cf>) £ E^i we 
get Vn DT^Proof (f)) and also Vn [0]^-iProof r{n, <f>). Then by applying an 
w-rule we see that [1]x()t4>- Since T is -^-introspective then [l]x 3YIPC^ (Y), 
and by Lemma EOI 

[i] x (3yipc^(r) -». ((0)^0 Ot^)), 

from which we conclude that [1]jc(0)^(^. 

So assume that A >- 1. If we have that (£)x4> then for every formula ip either 

1. for all rj -< £ there is n < w such that {r}) x~ , ip(n)i or 

2. 0t(Vo;^(.t) A0) holds. 

In the first case, by the induction hypothesis for £ ^ A we can see that 
3n [£]x(??}r _, V'(«); in the second, we have that [£]xOt(VxV5(2;) A 0). Combining 
these, we obtain 

V -< £, -> (3a;(f/)^^(±) V 0t(V^(x) A <£)) . 

Since -< is recursive, we know that n ^= £ — > [£]x 77 )== £. We thus see that, for all 
pairs (77, V), 

EU (»j £ V 3x^)5$-^(i) V 0t(V2^(z) A 0)) . 

By one application of the w-rule to all pairs (n, ?/>} (represented as natural 
numbers) we obtain 

[X]x (W>Vr? ~< £{MV)1^{&) V 0t(VxtA(.t) A 0))) , 

and by definition f Lemma 15.1 1111 applied under the box) we get [X]x (Ot^- ^ 

We have essentially proven that GLP^ is sound for its omega-rule interpre- 
tation, but we need the following definition in order to make this claim precise. 

Definition 6.6. An arithmetic interpretation is a function f : P — > Ly. 

We denote by the unique extension of f such that f^(p) = f(p) for 
every propositional variable p, /^(_L) = _L, f^ commutes with Booleans and 
#([A]0 = [A£ ft (<f>). 
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Theorem 6.7 (Soundness). If -t is any recursive well-order on the naturals, U 
is a sound theory extending ACAo, T is ^-introspective and representable and 
GLP^ h <j) then h (</>) for every arithmetic interpretation f. 

Proof. By an easy induction on the length of a GLP^-proof of 0, using the fact 
that each of the axioms is derivable. Necessitation is just Corollary 14.31 □ 

Now that we have proven that GLP^ is sound, our main objective will be to 
prove the converse of Theorem 16.71 which is hyper-arithmetical completeness of 
GLP^. For this, let us first review the modal logic J. 

7 The logic J 

It is well-known that GLPa has no non-trivial Kripke frames for A > 1. In order 
to remedy for this situation, we pass to a weaker logic, Beklcmishcv's J. The 
logic J is as GLP W where we replace the monotonicity axiom of GLP W by the two 
axioms 

6. [n] — > [m][n]4>, for n <m and 

7. [n] — > [n][m]0, for n < m. 

The logic J is proven in [3] to be sound and complete for the class of finite 
Kripke models (W, (> n )n<Ni [•]) such that 

1. the relations <„ are transitive and well-founded, 

2. if n < m and w < m v then < n (w) = < n (v) (where < n (w) — {u : u <„ w}) 
and, 

3. if n < m then w < m v <„ u implies that w <„ u. 

It will also be convenient to define some auxiliary relations. Say: 

• w <C n V if for some m > n, w < m v and, 

• w v if w < n v or there is u £ W such that w <C ri u and v ■Cn+i u - 

By the above frame conditions it is easy to see that <C n is transitive and well- 
founded. 

We will also use ;C n and <jS n to denote the respective reflexive closures. 
Let w n denote the symmetric, reflexive, transitive closure of <Cn and let [w] n 
denote the equivalence class of w under «„. Write < n if there 

exist w' S [w]„+i, v' € [v] n +i such that w' <„ v' . 

A J-frame W is said to be stratified if whenever [iu] n+ i < n [v] n+ i, it follows 
that w < n v. Note that the property of being stratified in particular entails the 
modally inexpressible frame condition that w < n v and w < m u implies u < n v 
whenever m > n. With this we may state the following completeness result also 
from [3J: 
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Lemma 7.1. Any J- consistent formula can be satisfied on a finite, stratified 
J-frame. 

Thus if we can reduce GLP U to J, we will be able to work with finite well- 
behaved Kripke models. For this, given a formula <j> whose maximal modality 
is N, define 

MO) = f\ [n]4> -> [m]tp. 

[n] ^/j£sub(0) 
n<m<N 

Then we set M+(cf>) = M(4>) A A n<N [n]M(<f>). 
The following is also proven in~[3|: 

Lemma 7.2. For any formula <f> £ C u , GLP W h <^> if and only if 

J h M+0) -> 0. 

We shall use these results in the next section to prove arithmetical complete- 
ness by "piggybacking" from the completeness of J for finite frames. 

8 Completeness 

In this section we want to prove that GLP^ is complete for its w-rule interpre- 
tation. This means that, given a consistent formula <f>, there is an arithmetic 
interpretation / such that ->f^ (</>) is not derivable in T (we will make this claim 
precise in Theorem 18.21) . 

There are many proofs of completeness of GL and GLP W , and it is possible to 
go back to an existing proof and adjust it to prove completeness in our setting. 
Because of this, we should say a few words about our choice of including a full 
proof in this paper. There are essentially two reasons. 

The first is that, while our result follows to a certain degree from known 
proofs, it does not follow from known results; even then, there would be several 
technical issues in adjusting known arguments to our setting, as they make 
assumptions that are not available to us. 

The second is that the argument we propose carries some simplifications 
over previous proofs that could also be applied to standard interpretations of 
GLP W , thus contributing to an ongoing effort to find simpler arguments for this 
celebrated result. 

To be more precise, there are at least six proofs in the literature: 

1 . Solovay originally constructed a function h with domain a; of a self- referen- 
tial nature and used statements about h to prove the completeness theorem 
for the unimodal GLPi [12] . The proof used the recursion theorem. 

2. De Jongh, Jumelet and Montagna introduced a modification using the 
fixpoint theorem instead of the recursion theorem [7J, where the function 
h is simulated via finite sequences that represent computations [7J. This 
approach is presented in greater detail in [6]. 
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3. A more elementary construction using the simultaneous fixpoint theorem 
is also given in [7]. 

4. Japaridzc proved completeness for GLP W with essentially the w-rule inter- 
pretation we are presenting here [10] . 

5. Ignatiev generalized this result to a large family of "strong provability 
predicates" [5]- 

6. Beklemishev gave a simplified argument using the logic J, which is very 
well-behaved. However, this proof still considers a family of N Solovay 
functions h n with domain u>, where iV is the number of modal operators 
appearing in our "target formula" <fi. 

Despite these strong provability predicates being quite general, they do not 
apply to our interpretation, as for example it is assumed that they are of increas- 
ing logical complexity whereas our iterated provability operators are all given 
by a single II} formula. The argument we present here, aside from being the fist 
that considers aribtrary recursive well-orders, combines ideas from [7] and [I] 
by considering finite paths over a polymodal J-frame. We do so by introducing 
an additional trick, which is to work with all modalities simultaneously, where 
our path makes a A„-step whenever appropriate. Readers familiar with known 
proofs might find it surprising that this is not problematic, but indeed it isn't 
and otherwise the argument proceeds as in other settings. As always, we will 
mimic a Kripkc structure using arithmetic formulas and define our arithmetic 
interpretation based on them. 

Since GLP^ is Kripke incomplete, we will resort to J-models instead. These 
models are related to GLP U as described in the previous section. The step from 
GLP^ to GLP U is provided by the following easy lemma which is also given in 

m- 

Lemma 8.1. Let 4> be a GLP^ formula whose occurring modalities in increasing 
order are {Ao, . . . , Ajv}- By (f> we denote the condensation of <f> that arises by 
simultaneously replacing each occurrence of by [i]. It now holds that 

GLP x F</> => GLP W ^^. 

Proof. Arguing by contrapositivc, given a GLP w -derivation d of 4> we may replace 
every occurrence of [n] in d by [A n ], thus obtaining a derivation of <j). □ 

With this easy lemma at hand we may give an outline of the proof of our 
completess theorem, which reads as follows. 

Theorem 8.2. If '-< is recursive, T is any sound, representable, ^-introspective 
theory extending ACAo and proving wo(-<) and (f> is any L^-formula, GLP^ h cp 
if and only if, for every arithmetical interpretation f, h f^{<f)- 
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Proof sketch. One direction is soundness and has already been established. 

For the other, if GLP^ V <j> then by our above Lemma [8.11 combined with 
Lemma ITT21 M + (cj)) A ~^4> is n °t provable in J. 

Thus by Lemma [7.11 M + (4>) A can be satisfied on a world of some 
J-model ffl = (W',(> n ) n<N ,lj) where W = [l,M] for some M > 1. We 
construct a new model 20 which is as W 1 only that now a new <o-maximal 
root 0. The valuation of propositional letters on is chosen arbitrarily and is 
irrelevant. 

The next ingredient is to assign to each w € W an arithmetic sentence o~ w 
so that the formulas er are a "snapshot" of 2B. We will make this precise in 
Definition 18. 4[ but let us outline the essential properties that we need from er. 

First, we need for the arithmetic interpretation / that sends a propositional 
variable p to f(p) := Vtue[p] a w *° have the property that 

2U, w Ih i> TV- a w -> f£(il>) 

for each w €E W and each subformula ip of <f>. In particular we have T h a Wt — >• 
(0) from which we obtain 

ThOr^i ->-.D T /^W). (8) 

Our desired result will follow if the formulas er satisfy two more properties: the 
second is that 

T h (T -> Oto-i, 

and the third, that N |= ctq. By the assumption that T is sound we conclude 
that N |= -iOt/t ( < / ) )- Hence, f^{4>) is not provable in T which is what was to 
be shown. □ 

Before we proceed to give the details needed to complete the proof we state 
as an easy consequence of our arithmetic completeness theorem the following 
lemma which was also proven by purely modal means in [5]. 

Corollary 8.3. Given a recursive well-order -< and an Lu-formula <f> we have 
that 

GLP^ h 4> GLP W h 4>. 

Proof. One direction is Lemma [5TTI For the other direction, suppose GLP W V <f>. 
By the proof of Theorem 18.21 we find an arithmetical interpretation / so that 
ACAo^ V ((f)). By the soundness theorem (Thm. 16. 7p we conclude that 
GLP^F0. □ 

Before entering into further detail, we first say what it means that a collection 
of sentences er = {a , ■ . ■ ,erfc} is a snapshot of a Kripke structure with nodes 
{0, . . . , k} inside a theory. Most importantly, this means that each world w will 
be associated with an arithmetic sentence <r w so that this sentence carries all 
the important information in terms of accessible worlds. 
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Definition 8.4. Given a sequence 

A = A -< Ai -< . . . -< Ajv-i, 

a finite J-model 2U = (W, (<n)n<AT; [■]) with root 0, and a formal theory T, a 
family of formulas {a w : w E W} is a A-snapshot ofWinT if 

2. T + a w h {\ti)t' t v for all n < N and v <„ w, 

3. for all n < N and for each world m^O, 

T + a w h [A~ n ]^ \J o~ v 

IfW, cr, A, T are as above we will write cr : 23J ^ T. 

Lemma 8.5. Suppose that a : 2H T , is an L^-formula with modalities 

amongst A such that W |= M + (<fi), and f(p) := Vmg[ p ] a w- 
Then, for all w G W and every subformula ?p of <$>, 

1. ifwel^jj thenT + a w \- ft(ip) 

2. ifw £ [V>] thenT + a w h -./^(^) 

Proof. By an easy induction on the complexity of ■0. □ 

In the remainder of this section, we shall mainly see how to produce snap- 
shots of a given Kripke model 2U in a theory T. We define the corresponding 
sentences o~ w for w € W in a standard way as limit statements of certain com- 
putable Solovay functions. 

One important notion in all known Solovay-style proofs, including our own, 
is the notion of a "code for a ^-derivation of 0." 

Definition 8.6. Let X be a set of natural numbers. A code of a 0-proof of <fi 
over X is any natural number m satisfying Proof rim, (j>). We assume that every 
derivation proves a unique formula in our coding, and that this fact is derivable; 
we also assume that every derivable formula has arbitrarily large derivation^. 
For £ >- ; a triple (£, n, m) codes a ^-derivation of </> over X if £ >- £ and 

1. n = r i]P for some ip such that, given k < lo, [£\xip(k) and 

2 Usually, derivations are represented as sequences of formulas, and any given derivation 
can be considered to only prove its last formula. Similarly, if derivations are represented as 
trees, then only the root is considered to be proven. Moreover, in standard proof systems, 
given a derivation d, there are ways to produce a longer derivation with the same end-formula; 
for example, one may add many redundant copies of an axiom at the beginning of d. 
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2. m is a code of a -proof ofWxip — > 4>- 

Let Proof x (x, £, (j>) be a formula stating that x = (£, d) codes a ^-derivation 
of tfi over X . 

Of course in Proof x the intention is for X to be an iterated provability 
operator, and we may define 

Proof ^ = VX(IPC^(A) -> Proofs). 

Note that formula Proof j, is of rather high complexity (11} ) which is moreover 
independent of £. However, the behavior of Proof ^ (x, £, </>) is simple in the eyes 
of A provability whenever A )p £, as is expressed in the next lemma. 

Lemma 8.7. Let T be a theory extending ACAq.. For £ ==! A we have 

1. h Vxi(\/<t> Proof £(x,€,<f) [A]^Proof^(x, 

2. h VxV£V0 -Proof ^(x, £,</>)-> [A]^Proof^(x,£,0). 

Proof. We prove the first item. We reason in and assume Proof ^(x, £, </>). 
If £ = 0, Proof ^(d, is A° so [0]xProof 0). So we assume £ >- whence 
Proof t(g?, Vxt/^x) —> <p) is equivalent to 

x = (V>, /i, d) A fj,^ A Vn[/x]y A Proof T (d, \/xip(x) -)• 0). (9) 

All conjuncts other than Vn[/i]y^i(n) are of complexity A? so they -as their 
negations- all are 0-provable whence certainly A-provable. By Lemma 16.41 we 
obtain \/n[p]^Tp(n) — > \/n\p]^ [p]? tp(h), and since p. -< A we use one application 
of the w-rule to see that 

Vn[yu]y^(n) — > [A]y Vn[/i]y?/>(n). 

Since the [A]Ji predicate is closed under conjunction we have the entire conjunc- 
tion (JHJ) under the scope of the [A]y predicate which was to be shown. 

The second item goes analogously now using Lemma 16.51 instead of 16.41 □ 

8.1 Solovay sequences 

Let us define a Solovay sequence or path; these sequences are given by a recursion 
based on provability operators which depends on a parameter <ft. Later we will 
choose an appropriate value of <f> via a fixpoint construction. We shall use the 
following notation: Seq(x) is a Afj formula stating that x codes a sequence, 
last(x) is a term that picks out the last element of x, x C y is a Aq formula 
that states that x is an initial segment of y, \x\ gives the length of x and x v 
a term which picks the y-coordinatc of x. As in previous sections, it is not 
necessary to have these terms available in our language, as we can define their 
graphs and replace them by pseudo-terms, but we shall write them as such for 
simplicity of exposition. 

We will also define a (pseudo) term Lim which gives a formula stating that 
the paths satsifying </> "converge" to w: 
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Definition 8.8. Define 

Lim(0,u>) := 3s(^(j)(s) A Vs' 3 s </>(«') ->■ last(s') = 

We shall use these formulas to define our recursive paths. 

Definition 8.9. Let 520 = (W, (< n )n<N, [•]) &e a Kripke frame and let A = 
(^n)n<N a finite sequence. We define a formula s : T *g 20 | cf> by 

s :T ^W\(f):= 

Seq(s) A last(s) ^ 




= iy — > 



(A A ^ Proof x(a;, A„,^Lim(0,w)^ -> s K+1 = li; 

ri<A r -u<„Mi 

A ( V V Proof x(^, A n ,-iLim(^>,i;)J ->• s^+i = v 

n<Nv< n w 



We then set s :T ^-20 | <f> = MX \1PC^(X) -> s : T £ 93J | <£J . 

We should remark that s, X, ^ are variables and A, 20 are external parame- 
ters so that we are in fact defining a family of formulas. With this we can say 
what it means to be a Solovay path. 

Definition 8.10 (Solovay path). We define a Solovay path to be any natural 
number s satisfying the formula s : T ~? 2H defined using the fixpoint theorem 
on the parameter <j> in s : T ~? 20 | <j>, so that 

ACA h s : T ^> 2U O (s : T ^ 20 | r x : T 2U n ) . 
Further, we say w is a Solovay value at i if 

w~{T^ 2U} 1 := 3s (s : T ~> 20 A \s\ > i A s z = w) 
holds, and w is a limit Solovay value if it satisfies 

w ~ Lim{T ^ 2U} := Lim ( r x : T ^ 22T, w) . 

The following shows that Solovay values in fact define a function. 

Lemma 8.11. If U extends ACAo, T is any representable theory, 20 is a J- 
frame and A a ^-increasing sequence, it is derivable in U that 

1. VsV.s'(s :T&WAs':T&W^sQs'Vs'Qs) 
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2. W3s s:T $WA\s\> I 

3. \/i3lw w ~ ana 

4. VsVj < i u ~ {T ^ 2H}j Aw~{T^> W}, -► u) < 5. 
Froo/. 

1 Clearly it suffices to prove that 

((s : T £ 2B I <j>) A («' : T ^ 2H | 0) A % < \s\ A t < |.s'|) -► «< = aj, 

for then if s, s' are any two paths and, say, |s| < |s'|, it follows that Si = s[ for 
all i < \s\ and thus s C s'. Moreover, this formula is arithmetic and hence we 
may proceed by induction on i. 

The base case is trivial since sq = s = 0. For the inductive step, we assume 
w = Si = s'i- Then, we must have that either Proof x{h A n , -iLim, (f>, v)) holds for 
some v, n, or it does not. If it does, then the value of v is uniquely determined (as 

1 may be the code of a derivation of only one formula) and thus Sj+i = s' i+1 = v. 
Otherwise, AnAu<„«,~' Proof x (x, A n , -iLim(0, v)) holds and s i+ i = s' i+1 = w. 
Once again the claim follows by introducing universal quantifiers over X and <f>. 

2 The proof follows the above structure; here we observe that if s is a Solo- 
vay path, we may always add one additional element to s depending on which 
condition is met. 

3 This is immediate from items [T] and [2] 

4 By the recursive definition of a Solovay path, it is always the case that 
Sj+i ^0 s j- Since is transitive, this implies inductively that Si ^0 s j 
whenever j < i, and this induction can be easily formalized in U. 

□ 

Lemma 8.12. Let 2U be a finite S-frame and X a ^-increasing sequence. Sup- 
pose further that U extends ACAo, -< is recursive and T is representable and 
-(-introspective, w € W and n < N . Then, 

Further, 

h m < n A u > m w 

Au ~ {T § W} k A w ~ {T $ W} k+1 
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Proof. Reasoning within U, we will prove both claims simultaneously. To be 
precise, we show by induction on k that 

IPC^(X) A s : T 2B | r x : T 2TT A \s\ > k -> 

f\ s k = w -> [A„]xVa; a: : T 2XJ A \x\ > k -> x fc « n+1 iU 

A A Sfc > m w — >■ [A„]xVa; ce : T ~> 2U A |x| > i — > ie,+i = w. 

Case 1. Suppose that w < m Sfe for some m < n. Then, k codes a X m - 
derivation of w qk Lim{T 2B}, and by Lemma [8.7111 

[A„] x Proof £ (k, X m ,w t Lim{T ^ 2B}) . 

Meanwhile, for u — Sk, by our induction hypothesis 

[K]x{x :T £>VBA\x\> k^x k «„ +i u), 

but Xk u <m w provably implies that Xk < m w by the J-frame conditions 

and thus 

[\n] x Vx(x : T & 2B A \x\ > k + 1 -)• x- k+1 = w\ . 
The claim follows by quantifying over all X. 

Case 2. Suppose that for no m < n do we have that Sk+i < m Sfe; then as in 
Case 1 we have that w < m Xk if and only if w < m Sk and by Lemma 18.7121 we 
have for each such w and m that 

[\ n ]£ -.Proof £ (k, X m ,w^ L±m{T 22}}). 

Thus in view of Lemma 18.11141 and the previous case we must have that 

IH 

Xk+l ^n+l x k ~n+l Sk ^,1+1 Sfe+1, 

which by definition implies that Xk+i ~ n +i Sfe+i- Formalizing this reasoning 
within T, it follows that 

[\ n ] x Vx(x :T ^>WA\x\>k + l^ x h+1 w n+ i t«Y 

and once again we conclude the original claim by quantifying over X. □ 

From here on, it remains to show that the formulas w ~ Lim{T 2U} give 
a snapshot of our Kripkc model. 

Lemma 8.13. If U extends ACAo, -< is recursive and T is representable and 
-<-introspective, m < n < N and v < m w then 

U + w~ Lim{T 2U} h (A n )^ v ~ Lim{T 4 2U}. 
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Proof. Towards a contradiction, suppose that 

[\ n ]l U^Lim{T^2IJ}. 

It follows that [A„]y v c£ Lim{T 2U}, and hence there exists some i 
which satisfies Proof ^ (i, A„, v Lim{T A 2B}). Now, by assumption u> ~ 
Lim{T 2H} holds, and hence we may choose s such that Last(s') = w for 
all s' □ s. Recall that we assumed that every derivable formula has arbitrarily 
large derivations (see Definition , and thus we may pick i > \s\ such that 

Proof £ (i, A„, T7 ^ Lim{T ~> 2U}) 

holds and, in view of Lemma [8.11121 a Solovay path s' with \s'\ > i + 1. Then, 
= s^, j = w, but by the Solovay recursion we should have s' i+1 = v, a 
contradiction. □ 

Lemma 8.14. IfU,T extend AC A , -< is recursive andT is representable and 
-< -introspective, w =/= and n < N then 

+ w~ Lim{T 2U} h [A„]^ \/ w ~ Lim{T ^ 22J}. 

Proof. We reason in + w ~ Lim{T ~> 20} . Let s be a Solovay path with 
with to = Last(s). Let fc* < |s| be the greatest value such that Sfc„ <„ Sk„-i if 
there is such a value; otherwise set fc* = 0. 
By Lemma I8T21 

[A n ]^ (Vx x : T ^ 2U A \x\ > fc* -> x s< = s fc .). (10) 

Moreover, by Lemma 18.131 we have that (A m )y v ~ Lim{T 2B} so that by 
Lemma 16.51 we also have 

M A A ( X ™>t « - Lim { T $ ^ 

m<n v< m w 

from which it follows using Lemma 18.11141 that 

[A n ];£ Va; fc» < j A a; : T ~» 2B A |x| > j -> x.,- <„ x s< _ . (11) 

Putting (|T0|) and (fTTj) together, along with the fact that Sk, tk n +i 1,7 we see 
that 

[A„]^ Vx x : T ^ W A \x\ > fc* — > Last(x) ^„ uJ. 

It remains to disprove the case that Last(x) = W. For this, choose the least 
value of k such that Sk+\ = w\ note that this value is well-defined since sq = 0. 
It then follows that Proof^(fc, A„, w Lim{T ~> 2U}), and in view of Lemma 

18. 7111 the latter clearly implies that [X n ]^iv ck Lim{T 2U}, as required. □ 
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We are now ready to prove that w ~ Lim{T 20} provide a snapshot of 
our J-model. 

Lemma 8.15. Let T be any sound, ^-introspective theory extending ACAo. 
Given a finite S-frame 20 with root and any -<-increasing sequence A set 

Lim{T 20} = (w ~ Lim{T ^ 20} : w & W) . 

Then, 

Lm{T § 20} : 20 ^ T. 
Proof. We must check each of the conditions of Definition 18.41 

1 For the first, suppose that w ~ Lim{T ^ 20} and v ~ Lim{T 20} hold. 
In view of w ~ Lim{T A 20}, pick a Solovay path s such that any extension 
of s has last element w and similarly s' such that any extension of s' has last 
element v. By Lemma T8. 11111 either s □ s' or s' □ s; in either case, it follows 
by w ~ Lim{T ~> 20} A w ~ Lim{T ~» 20} that iu = v. 

2-3 The second condition is Lemma 18.131 and the third, Lemma 18.141 

4 For the fourth, we must use the fact that [A]^ is sound for all A and proceed 
by induction on <Co to show that, if s is a Solovay path and w ^ 0, then s, ^ 
for all i. For indeed, if Sj = w ^ for some i, picking the minimal such i we 
see that i codes a A n -dcrivation of w ^ Lim{T A 20}; hence, by soundness we 
must have that, for some s' □ s, last(s') ^ w. But then, by Lemma [8.11141 
last(s') = v <Co w, but by induction on v <Co w there can be no such path. 

We conclude that any Solovay path is identically zero, so that the formula 
~ Lim{T 20} is true. □ 

We may finally prove our main completeness result. 

Proof of Theorem We have already seen that the logic is sound. 

For the other, if <fi is consistent over GLP^, then by Lemma 17.21 M + (</>) A <j> 
is consistent over J and thus by Lemma 17.11 M + (cf>) A cf> can be satisfied on a 
world w* of some stratified J-model 20'. Define 20 by adding as a root to 20' 
and let A be the modalities appearing in <p. By Lemma 18.151 

Lim{T ^ 20} : 20 ^ T 

so that by Lemma l8~5l 1 . 

T^ + w, ~ Lim{T ^> 20} h f£(4>). 
Hence, by lemma [8~5l 2. N |= Ot/t (4>)j 1 - e - It (^) i s consistent over T. □ 
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A Alternative provability predicates 



In this section wc shall briefly discuss some variants of our provability predicates. 
We do so in an informal setting and in particular shall refer to defining recursions 
rather than formalizations in second order logic. Moreover, we shall on occasion 
not be too concerned about the amount of transfinite induction needed in the 
arguments. 

We could consider an apparently slightly weaker notion of a provability - 
let us write [a]^' 1 " - defined by the following recursion: 

[ap w 4> a T cj)V3ij3p^a(Vn[f3p w i>(n) A[/3p w (Vxt(;(x) 

However, it is easy to sec by transfinite induction that [a] T '"'0 [a]^(j>. 
The <= direction is obvious. For the other direction we assume that we can 
formalize the notion of just like [a]^ and prove all the necessary lem- 

mata like monotonicity, distribution axioms, etc. Suppose that Vn [0]^ ' w ip(n) A 
[fH]^' w (yxip(x) — > <p) for some formula ip an d ordinal /3 -< a. Then, clearly also 

\/n[/3p w (if;{n)A{\/xi>(x) -> </>)). But, as [0$ ((Var i/>(x) A(Vx ip(x) -> </>)) -> ^ 
we get 

Vti [/3p w (^{n) A (S/xi/>(x) -> </>)) A [0]((Vxip(x) A (Vxip(x) -> </>)) -> A 
which by the induction hypothesis for /3 is just [cc]^0. 

Note that in our definition of [a]^ there is still some uniformity present in 
that we choose one particular /3 -< a with [)3]Jiip(n) for all numbers n. We can 
make this j3 also dependent on n. In a sense, this boils down to diagonalizing 
at limit ordinals. Thus, we define our notion of [et]y' as follows: 

[a\T' d 4> :<S> U T 4> V 3i>(Vn3/3 n -<a ([^ n ]^' d tp(n) A □(Vx i/>(x) 0))) . 

By an argument similar as before, we see that, also in this notion we can re- 
place the n(\/xip(x) — > (f>) by 3j~<a [^]^' d (^x tp(x) —> cj>) without losing any 
strength. This new notion of provability is related to [a]^ in a simple fashion as 
is expressed in Lemma I A. 21 below. Again, we assume that we can formalize the 
notion [a]^' d in a suitable way so that the basic properties are provable. We 
first state a simple but useful observation. 

Lemma A.l. 

1. [a + l]£(j> 3ipfan [a]^(n) A n(Vxip(x) 4>)\ 

2. [a + l]^' d <p <=> 3v(Vn [a}^' d tp(n) A n(\/xip(x) ->• 4>j\ 

Proof. This follows directly from the definition and monotonicity. □ 
Lemma A. 2. 
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1. [n\j,<t> [ n \T <t> f or n € w > 

2. [a + 1]^ [a]^ d 4> for a)puj. 

Proof. The proofs proceed by induction on n and a, respectively, and we omit 
them. □ 

As can be seen, there is a fair amount of freedom in defining transfinite 
iterations of the w-rule. We chose the current paper's presentation both for the 
sake of simplicity and because a more refined hierarchy is in general terms more 
convenient; after all, it is easy to remove intermediate operators later if they 
are not needed. We also suspect it will be the appropriate notion useful later 
for a n^-ordinal analysis of second-order arithmetics, a goal which now seems 
well within our reach. 



B An afterword on the choice of our base theory 

In this paper we have shown sound and completeness of the logic GLP^ for the 
interpretation where each [£] modality is interpreted as "provable in ACAo using 
at most £ nested applications of the omega-rule" . The main applications we 
have in mind with this result is to provide ordinal analyses of theories much 
stronger than PA in the style of Beklemishev ([!]). For the mere soundness of 
the logic however, there were quite some strong principles needed: the existence 
of an iterated provability class, plus a certain amount of transfinite induction. 
We shall discuss here how these principles fit into the intended application of 
ordinal analyses. 

A consistency proof of U in Elementary Arithmetic (EA) plus TI(fl5, — <) 
(using a natural ordinal notation system for large enough ordinals) is closely 
related to the IIj ordinal analysis of U and we shall focus our discussion on 
such a consistency proof. Such a consistency proof can be seen as a partial 
realization of Hilbert's program in the sense that over finitsitic mathematics 
one can prove the consistency of a strong theory with just one additional non- 
finitist ingredient. As such one could say that U is safeguarded by this method. 
If one accepts this method of safeguarding it makes philosophically speaking 
sense that one may use U itself as new base theory to safeguard even stronger 
theories by the same method. It is in this perspective that having ACA as our 
base theory is not a bad thing since ACAo has already been safeguarded over 
EA using some amount of transfinite induction. However, for technical reasons 
it might be desirable to dispense with such an intermediate step. 

In [TT] it is noted that soundness of GLP^ suffices to perform a consistency 
proof and completeness is actually not needed. But also in the soundness proof 
presented in this paper we needed transfinite induction as well as resorting to 
the introspective closure of a theory. However, as we have seen in Corollary |5.8[ 
for the sake of consistency-strength it is irrelevant to consider either a theory 
or its introspective closure as both theories are provably equiconsistent. Thus, 
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to conclude, let us consider the amount of transfinite induction needed in our 
soundness proof of GLP^. 

First of all, let us note that our soundness proof of GLP^ uses at most 
Tl(n°, -<). In a sense, this is not bad at all, because it is exactly this ingredient 
(in parameter free form) that is added EA to perform a consistency proof of 
our target theory. So, by adding this amount of transfinite induction (with 
parameters) to EA, we get access to exactly the soundness of GLP^ needed to 
perform this consistency proof, were it not for the case that our base theory was 
taken to be ACAo, not EA. This choice of ACAo has been mainly to simplify 
our exposition and the needed amount of arithmetic can be pushed down a lot 
further. 

We observed that to prove Tl(n°, -<) over EA^ we need comprehen- 
sion. But clearly comprehension with second order parameters proves ACAo. 
However, close inspection of the proofs in our paper shows that the only free 
set-parameters needed are occurrences of iterated provability classes. Thus if 
we enrich our language with a constant n with an axiom stating that 7r is an 
iterated provability class (see Lemma I5.10[) . we can do with parameter free 
comprehension since then TI(IT] ) , -<) suffices. 

However, we can do better still in the sense that we need less comprehension 
by allowing slightly stronger well-ordering assumptions as we shall see in the 
next lemma. 

Let us fix some bijective coding of a on the naturals, and let -< be a primitive 
recursive well-order on a. Let < denote the usual ordering on the natural 
numbers. Using a bijective pairing function we define a new relation 

(£,fl) V (C,m) :=C^CV(e = CAn<m). 

Clearly, -<,' provably defines a relation of order type u> ■ a. With this notation 
we can now state our lemma. 

Lemma B.l. Ag-CA + wo(w • a) h TI(f[?, a). 

Proof. By the usual argument we see that Aq-CA + wo(w • a) h TI(Aq,w • a). 
Thus, we shall proof TI(fl] ) ,a) using TI(Aq,w • a). Let ip(z, x) be some A[j 
formula and assume 

Vx (V y<x \fzip(z, y) — > \/zip(z, x)). (12) 

If we assume that Vy-<'.T <p(yi,yo), using (|12p we get (p(xi,Xo) whence by 
Tl(Ao,k> • a) we obtain \/xVzip(z,x). □ 

Note that u> ■ a is not much larger than a. In particular, if the last term in 
CNF of a is at least w w we get that uj-a = a. Thus, for natural proof theoretical 
ordinals we have this equation whence we get the extra induction for free. 
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